PT-2025-50292 · Mastodon · Mastodon

Sugar700 · Published 2025-12-09 · Updated 2025-12-11 · CVE-2025-67500

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.2.27 and prior Mastodon versions 4.3.0-beta.1 through 4.3.14 Mastodon versions 4.4.0-beta.1 through 4.4.9 Mastodon versions 4.5.0-beta.1 through 4.5.2

Description Mastodon, a free and open-source social network server based on ActivityPub, contains discrepancies in error handling. An attacker with knowledge of a status identifier, even if unauthorized to view it, can determine the status's existence by sending a request with a non-English Accept-Language header. This does not allow access to the status content or any other properties beyond its existence.

Recommendations Update to Mastodon version 4.2.28 or later. Update to Mastodon version 4.3.15 or later. Update to Mastodon version 4.4.10 or later. Update to Mastodon version 4.5.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

BIT-MASTODON-2025-67500

CVE-2025-67500

GHSA-GWHW-GCJX-72V8

Affected Products

Mastodon

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67500.json · Exploit
• https://github.com/mastodon/mastodon/pull/37077/commits/9957d3218cb33fea6a44bb285e2ba4795a059e4f · Patch
• https://github.com/mastodon/mastodon/security/advisories/GHSA-gwhw-gcjx-72v8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67500 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67500 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mastodon-2025-67500 · Vendor Advisory
• https://twitter.com/CVEnew/status/1998732760534626440 · Twitter Post
• https://t.me/CVEtracker/39322 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1998666689882333611 · Twitter Post